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ABSTRACT 


-"A  special  class  of  self-timed  networks  is  defined  and  two  steps  are 
suggested  for  the  verification  of  any  computation  performed  on  networks  in 
this  class.  First,  a  proof  that  the  network  is  deadlock-free,  and  second, 
a  verification  of  the  results  of  the  computation.  In  relation  to  the  first 
step,  an  algebra  of  events  is  developed  and  used  to  prove  that  the  liveness 
of  any  self-timed  network  is  determined  uniquely  by  its  initial  state. 
Moreover,  a  method  is  presented  for  the  verification  of  liveness  in  networks 
preset  to  given  initial  states.  In  order  to  verify  the  results  of  deadlock- 
free  self-timed  computations,  general  VLSI  cellular  networks  are  defined  to 
include  both  systolic  and  self-timed  computational  arrays.  A  model  for  the 
verification  of  computations  on  these  networks  is  then  obtained  by  the 
generalization  of  a  previous  model  that  was  suggested  for  systolic  compu¬ 
tations. 
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1.  INTRODUCTION 

Systolic  arrays  18]  and  self-timed  systems  [17]  are  two  different 
approaches  for  the  organization  of  large  VLSI  computing  networks.  In 
systolic  arrays,  a  global  clock  Is  used  for  the  synchronization  of  all 
the  cells  In  the  network.  This  global  control  leads  often  to  simple  designs, 

but  may  create  problems  in  large  arrays  due  to  the  non-simultaneous 
arrival  of  clock  signals  at  the  different  cells  (clock  skew).  On  the  other 
hand,  synchronization  In  self-timed  systems  Is  achieved  by  local  protocols 
between  neighboring  cells.  This  requires  some  additional  hardward/ firmware 
and,  hence,  may  lead  to  expensive  Implementations. 

The  reliability  of  the  operations  of  clocked  networks  depends  on  the 
ability  to  ensure  the  arrival  of  Inputs  and  the  collection  of  outputs  on 
time.  Namely,  a  failure  to  supply  the  network  with  an  Input  item  on  time 
may  result  In  Its  malfunction,  and  an  output  Item  that  Is  not  sampled  on 
time  may  be  overwritten  by  other  data,  and  thus  lost.  If  the  network  Is 
managed  by  a  host  computer,  then  any  mismatch  between  the  nominal  I/O  rate 
of  the  network  and  the  capability  of  the  host  to  handle  I/O  may  be  detected 
during  the  design  phase.  However,  problems  may  occur  If  the  clocked  network 
Is  a  component  In  a  larger  system  and  receives  Its  Input  from  (or  delivers 
Its  output  to)  other  components  that  may  have  different  I/O  rates  or,  even 
worth,  variable  I/O  rates. 

A  similar  situation  arises  when  a  network  Is  designed  for  use  in  real 
time  environments,  where  the  time  of  arrival  of  the  Input  Items  Is  not 
determined  a  priori.  Examples  of  such  networks  are  the  priority  queue  net¬ 
work  [12]  that  may  be  used  to  hold  service  requests  In  an  operating  system, 
and  the  data  base  machine  [1]  where  the  time  of  arrival  of  a  certain  trans¬ 
action  Is  a  real  time  event.  These  reasons.  In  addition  to  the  ones  argued 
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for  in  110],  may  justify  the  consideration  of  the  more  complex  and  expensive 
self-timed  computational  arrays,  despite  the  facts  that  equivalent  clocked 
arrays  may  be  designed  for  most  self-timed  arrays  and  that  the  effect  of 
the  clock  skew  may  be  kept  under  control  [7]. 

Self-timed  techniques  (sometimes  called  data  driven  techniques)  may  be 
easy  to  apply  on  pipelined  systems  where  data  flows  in  one  direction. 

However,  it  seems  that  little  attention  has  been  paid  to  the  complications 
that  may  result  from  applying  these  techniques  to  networks  with  data  flowing 
in  more  than  one  direction.  More  specifically,  a  network  may  be  deadlocked 
if  each  cell  is  waiting  to  receive  its  input  from  other  cells. 

In  this  paper,  we  consider  a  class  of  self-timed  computational  networks 
where  each  cell  does  not  start  its  computation  before  all  Its  Inputs  are 
available,  and  does  not  output  the  results  before  all  previous  outputs  are 
consumed.  This  class,  simply  called  here  self-timed  networks.  Is  precisely 
defined  in  Section  2  as  a  subclass  of  VLSI  cellular  networks;  a  more  general 
class  that  Includes  also  systolic  networks. 

The  model  that  we  suggest  in  Section  4  for  the  verification  of  the 
results  of  both  clocked  and  self-timed  computations  Is  a  generalization  of 
a  previous  model  [15]  that  was  shown  to  be  effective  in  the  verification,  as 
well  as  the  simulation,  of  systolic  computations.  The  basic  idea  Is  to 
represent  the  data  items  that  appear  on  any  communication  link  In  the  network 
by  a  data  sequence,  and  to  model  the  operation  of  each  cell  by  a  set  of 
equations  that  Includes  operators  on  sequences.  The  verification  of  the 
computation  may  then  be  accomplished  by  solving  the  system  of  equations  that 
models  all  the  cells  In  the  network,  for  specified  Inputs. 

However,  In  order  to  keep  the  model  relatively  simple,  we  assume  that 
the  computation  Is  deadlock-free,  a  temporal  condition  that  Is  not  satisfied 
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always  In  self- timed  networks.  Hence,  a  proof  that  a  given  self-timed 
computation  is  deadlock-free  is  necessary  before  the  abstract  model  may  be 
used  to  verify  its  results.  The  goal  of  Section  3  is  to  provide  a  technique 
for  such  proofs. 

Many  methods  were  Introduced  In  the  literature  for  the  verification  of 
temporal  properties  in  communicating  processes  (see  e.g.  [2],  [4])  and  In 
asynchronous  systems  (see  e.g.  [16]).  However,  these  techniques  do  not 
seem  adequate  for  the  type  of  results  that  we  are  seeking.  More 

specifically,  we  want  to  prove  that  deadlock  In  self-timed  networks  depends 
uniquely  on  the  initial  state,  and  then  identify  the  Initial  states  that 
guarantee  deadlock- free  computations. 

In  order  to  obtain  these  results,  we  develop  an  algebra  of  events, 
where  the  execution  history  of  a  network  is  represented  by  a  sequence  of 
events  and  the  state  of  the  network,  at  any  time,  is  represented  by  a  state 
matrix.  The  occurence  of  each  event  causes  a  transformation  in  the  state 
matrix  according  to  some  axiom.  This  algebra  proved  to  be  useful  for  the 
study  of  different  properties  of  execution  histories  and  their  dependency 
on  the  initial  state  of  the  network.  Similar  algebras  of  events  were 
introduced  in  [3]  and  [133  but  used  In  different  contexts. 

Finally,  we  present  an  example  in  Section  5  to  Illustrate  the  Ideas 
and  techniques  discussed  in  Sections  3  and  4. 
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2.  VLSI  CELLULAR  NETWORKS 

A  VLSI  cellular  network  Is  defined  here  as  a  set  of  cells,  each  having 
a  certain  number  of  input  and/or  output  ports,  and  a  set  of  unidirectional 
communication  links,  each  connecting  an  output  port  of  some  cell  to  an 
input  port  of  another  cell. 

A  communication  link  £.j  directed  from  an  output  part  of  a  cell  c^ 
to  an  input  part  of  another  cell  Cj  is  a  medium  that  carries  always  one 
data  item  of  a  certain  type.  At  any  instant,  this  medium  may  be  in  one  of 
two  states,  namely  RE  (read  enabled)  or  WE  (write  enabled).  Both  c^  and 
c1  may  examine  the  state  of  £•.,  but  data  may  be  written  on  It  only  by  c1 
and  read  from  it  only  by  c^.  The  state  of  is  set  to  RE  whenever  a 

data  item  is  written  by  c^  and  to  WE  whenever  its  content  Is  read  by  Cj. 

At  the  beginning  of  the  operation  of  the  network,  may  be  either  Initially 

read  enabled  (IRE)  or  initially  write  enabled  (IWE).  Note  that  the  above 
abstract  definition  of  a  link  is  Independent  of  any  particular  Implementation 
of  the  medium  or  the  states.  We  will  use  the  usual  convention  of  calling 
l.|j  an  output  link  of  c^  and  an  input  link  to  Cj  and  we  will  assume  that 
a  link  cannot  be  both  an  input  and  an  output  link  to  the  same  cell.  This 
assumption  does  not  affect  the  computational  power  of  the  network  since  any 
direct  feedback  to  a  cell  may  be  Included  in  Its  specification. 

The  cells  In  VLSI  cellular  networks  may  be  classified  Into  three  classes; 
namely,  1)  Input  cells  that  have  only  output  ports,  2)  output  cells  that  have 
only  Input  ports,  and  3)  computational  cells  that  have  both  input  and  output 
ports.  Each  cell  In  the  network  repeats  Indefinitely  the  execution  of  a 
specific  cycle  that  Is  synchronized  by  two  flags;  namely,  STR  (start  to  read) 
and  STW  (start  to  write).  More  specifically,  each  cell  executes  an  algorithm 
of  the  following  generic  form. 


Algorithm  GENERIC 


Repeat  forever 


Begin 

1:  If  (STR  3  false)  then  go  to  1 
else  Begin 

reset  STR  :3  false; 


(*  Busy  wait  *) 


Read  one  data  Item  from  each  Input  port  (if  any); 


Case  (cell -type)  of 

Computational:  Compute  a  data  Item  for  each  output  port  using  a  specific 
procedure  applied  to  the  data  read  since  the  beginning  of 
execution; 

Input  :  Create  a  data  Item  for  each  output  port ; 

Output  :  Inhale  the  data  Items  read  In  step  1; 


3:  If  (STW  •  false)  then  go  to  3 
else  Begin 


(*  Busy  wait  *) 


reset  STW  :«  false; 

Write  on  each  output  port  (If  any)  the  corresponding  Item  computed  or 
created  In  step  2; 


It  Is  easy  to  see  that  Systolic  networks  form  a  subclass  of  VLSI  cellular 
networks  In  which  all  the  links  In  a  network  are  IRE  and  the  flags  STR  and 
STW  of  all  the  cells  are  set  simultaneously  by  a  global  two-phase  clock.  On 
the  other  hand,  we  may  define  self- timed  networks  as  a  subclass  of  VLSI 
cellular  networks  In  which  any  link  may  be  either  IRE  or  IWE  and  each  cell 


sets  its  STR  and  STW  flags  asynchronously.  Namely,  a  cell  sets  Its  STR 
flag  when  all  Its  input  links  are  RE  and  sets  its  STW  flag  when  all  its 
output  links  are  WE.  A  cell  with  no  input  (or  output)  links  sets  the  flag 
STR  (or  STW)  as  soon  as  it  is  reset. 

In  order  to  obtain  a  useful  computational  model,  we  assume  that  the 
execution  of  step  2  In  algorithm  GENERIC  always  terminates.  This,  in 
particular,  assumes  that  a  data  item  is  eventually  supplied  whenever  the 
network  is  waiting  for  an  input  and  that  the  output  of  the  network  is 
eventually  consumed.  However,  an  output  item  does  not  have  to  be  consumed 
as  soon  as  it  is  produced.  In  fact,  this  is  the  reason  for  having  an 
"Inhale"  statement,  that  may  require  some  time  to  execute,  in  step  2  of 
algorithm  GENERIC. 

The  different  steps  in  GENERIC  provide  a  convenient  way  for  describing 
the  state  of  a  certain  cell  during  the  execution  of  a  network.  More  specifi¬ 
cally,  we  may  say  that  a  cell  is  in  state  R  (reading),  C  (computing)  or 
W  (writing)  if  it  is  executing  step  1,  2  or  3  of  GENERIC,  respectively. 

In  Section  4,  we  will  generalize  the  abstract  systolic  model  of  [151 
to  model  VLSI  cellular  networks.  This  generalization,  however,  will  be  based 
on  two  assumptions,  namely  that 

Al)  Each  cell  in  the  network  executes  infinitely  many  cycles. 

A2)  A  communication  link  is  WE  when  a  data  item  is  written  on  it, 
and  is  RE  when  a  data  item  Is  read  from  it. 

The  conditions  needed  to  validate  these  assumptions  are  straightforward 
for  systolic  networks.  Namely,  Al  Is  valid  if  the  global  clock  never  stops 
and  A2  Is  valid  If  the  period  of  the  clock  and  the  shifts  between  its  two 
phases  are  such  that  1)  the  shift  (^ )  between  phase  1  and  phase  2  is  large 


enough  to  execute  steps  1  and  2  of  GENERIC  in  all  the  cells  In  the  network, 
and  2)  the  phase  shift  between  phase  2  and  phase  1  (period  -  <j>^)  is  large 
enough  to  execute  step  3  of  GENERIC.  Note  that  this  should  include  the 
effect  of  the  clock  skew  and  the  time  needed  for  the  signals  to  stabilize. 

On  the  other  hand,  A2  is  satisfied  in  self-timed  networks  by  definition. 
However,  A1  may  be  violated  if  the  network  reaches  a  state  where  each  of  its 
cells  is  trapped  in  a  busy-wait  loop  in  either  step  1  or  3  of  GENERIC.  This 
is  a  typical  deadlock  situation  that  we  will  study  in  details. 


A  STUDY  OF  DEADLOCK  IN  SELF-TIMED  NETWORKS 


In  the  networks  considered  In  this  section*  we  assume  that  at  most  one 
link  may  be  directed  from  a  specific  cell  to  another  cell.  We  justify  this 
assumption  as  follows:  Let  l.  .  and  r *  -  be  two  links  directed  from 

1 ij  I ij 

cell  i  to  cell  j.  If  the  initial  states  of  l.  *  and  r.  .  are  different, 

*  fj  *  f J 

then  both  cell  1  and  cell  j  will  be  trapped  in  the  busy  waiting  loop  of 
step  3  and  step  1,  respectively,  of  algorithm  GENERIC.  Hence  both  cells  will 
be  blocked  indefinitely  and  no  further  study  is  needed.  If,  on  the  other 
hand,  the  states  of  l,  and  r .  .  are  initially  ident*'~l,  then  whenever 

•  *J  I  tj 

cell  i  executes  a  write,  or  cell  j  executes  a  read,  e  states  of  both 
li  .•  and.  r.  .  will  change.  In  this  case,  the  state.  F  the  two  links  may 

•  t  J  I 

be  expressed  by  the  state  of  a  single  link. 

We  will  also  assume  that  the  network  is  connected  in  the  sense  that  it 
cannot  be  partitioned  into  isolated  subnetworks.  If,  however,  such  partitioning 
does  exist,  then  deadlock  in  each  subnetwork  may  be  studied  independently. 


3.1  The  State  Matrix 

Let  N  be  a  self-timed  network  composed  of  n  cells  labeled  by  the 
integers  l,...,n  and  let  the  topology  of  N  be  specified  by  the  adjacency 
matrix  A  defined  such  that  A.  .  =  1  if  there  is  a  link  l.  ^  directed 
from  cell  1  to  cell  j,  and  A^  j  *  0  otherwise.  At  any  instant  during 
the  execution  of  N,  each  link  may  be  In  one  of  two  states,  namely  RE  or  WE. 
Hence,  the  states  of  all  the  links  in  N  may  be  expressed  In  terms  of  an 
n  x  n  matrix  S  defined  as  follows 


.r 


0 

if 

Ai.J 

=  0 

1 

if 

Ai  ,j 

-  1 

and 

L\  ,j 

is 

RE 

1 

if 

Ai,j 

*  1 

and 

£i,j 

is 

WE 

Noting  that  we  do  not  allow  direct  loops  in  N,  it  is  clear  that  the 
diagonal  elements  of  S  are  always  zeroes.  Hence,  S.  . ,  1  *  l,...,n, 

I  >1 

may  be  used  to  indicate  the  states  of  the  n  cells  in  N.  More  specifically 
we  set 

x-  1  if  cell  i  is  in  state  R 

Si  i  *  I  0  ^  ce^  ^  is  ln  state  c  ( 

-1  if  cell  i  is  in  state  W 

The  matrix  S  defined  by  (3.1)  and  (3.2)  is  called  the  state  matrix. 

3.2  Events  and  Instances  of  Events 


Given  a  particular  cell  i  in  a  self-timed  network,  we  refer  to  any 
change  in  the  state  of  that  cell  by  an  "event".  More  specifically,  the 
events  Ep  ^ ,  Ec  ^  and  Ew  ^  are  defined  as  the  events  of  leaving  state  R, 
leaving  state  C  and  leaving  state  W,  respectively  (see  Figure  1).  We  also 
define  the  t-th  instance  E^l  of  an  event  Ev  x  *  r,  c  or  w,  as  the 
occurence  of  Ev  *  during  the  execution  of  the  t-th  cycle  of  cell  i. 

X  §  1 


Figure  1 :  State  transition  diagram  of  cell  i. 
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The  statesof  the  links  connected  to  cell  1  play  a  key  role  In  the 
occurence  of  event -Instances  In  that  cell.  For  example.  If  cell  1  Is 
executing  step  1  In  the  t-th  cycle  of  algorithm  GENERIC,  then  It  may  not 
escape  the  busy  waiting  loop  unless  all  Its  Input  links  are  RE.  Once  this 
condition  is  satisfied,  the  ELSE  part  of  step  1  will  start  execution  leading 
to  the  eventual  termination  of  that  step,  that  Is  to  the  occurence  of  E^]. 
In  other  words,  the  occurence  of  any  Instance  of  E„  i  Is  feasible  only  If 
cell  i  is  In  state  R  and  all  Its  input  links  are  RE.  Similarly,  It  may 
be  seen  that  the  occurence  of  any  Instance  of  Ew  ^  Is  feasible  only  If 
cell  1  Is  in  state  W  and  all  its  output  links  are  WE.  Finally,  the 
occurence  of  any  instance  of  E„  *  is  feasible  only  if  cell  1  Is  In  state 
C.  This  argument  motivates  the  following  definitions: 


Definition  1:  Let  A  be  the  adjacency  matrix  of  a  network  N  composed  of 
n  ceTls.  Then  tk«  domain  of  any  event  E„  1  <  1  <  n,  .  fs  defined 

as  follows: 


dom<Ex.l) 


p  {(j.1)  |1  <  j  <  n, 
“  {(1»j)  |1  <  i  <  n. 


A,  i  =  1}  U{(i,i)} 

Aj j  *  1}U  {(1,1)} 


If  x 
if  x 
if  x 


r 

c 

w 


Definition  2:  Given  a  state  S  of  a  network  N,  an  event  Ev  *  Is  said  to 

X  ft  1 

be  feasible  at  S  if 

For  x  »  r  sj,1  “  1  0.1)  e  dom(Ex>1)  j 

For  x  8  c  S.{  i  *  0  (1,1)  e  dom(Ev  4)  ; 

y  v 

*  *  i 


For  x  ■  w 


-1 


(1,j)  e  dom(E  J 


Definition  3:  A  state  S  is  called  a  dead  state  If  no  events  are  feasible 
at  S. 


Clearly,  the  occurence  of  an  event  Instance  changes  the  state  of  the 
network.  More  specifically,  for  any  positive  integer  t,  the  occurence  of 
E^]  changes  the  state  of  cell  1  from  R  to  C.  Also  as  a  result  of 
reading  th«  Inputs,  the  states  of  the  input  links  to  cell  1  are  set  to  ME. 
Similarly,  the  occurence  of  E^*]  changes  the  state  of  cell  1  from  W 
to  R,  and  as  a  result  of  writing,  the  states  of  the  output  links  of  cell 
i  are  set  to  RE.  Finally,  the  occurence  of  E^]  changes  the  state  of  cell 
i  from  c  to  w.  This  is  formally  described  by  the  following  axiom. 

State  Transformation  Axiom 

Let  E„  *  be  an  event  feasible  at  a  state  S  of  a  network  N,  and  let 

A  f  1 

S  be  the  state  of  N  after  the  occurence  of  an  Instance  E^]  of  E„  . . 

X  fl  X  #1 

If  E^]  is  the  only  instance  that  occurred  between  S  and  S,  then 

X  >  I 

1)  For  (i,j)  t  dom(Ex>i) 

2)  For  ( i , j )  e  dom(EXj1) 

If  x  *  r  then 

If  x  =  c  then 

If  x  =  w  then 


S1  »j  *  Si  ,j 


5U*  [ 


-1  1  ¥  i 

o  i  *  j 


*ur-' 


si.j  *  1 


In  the  following  section  we  consider  the  interaction  between  the  different 


cells  in  the  network. 


3.3  The  Execution  History  of  Self-Timed  Networks 


An  execution  history  of  a  self-timed  network  N  may  be  expressed  by  a 
sequence  V, ,V2»...,  where  each  Vj  Is  a  set  that  contains  event  Instances. 
Every  event  instance  that  occured  during  execution  should  appear  in  some 
such  that  1)  each  set  contains  instances  that  occured  simultaneously,  and 
2)  V_j_j  contains  instances  that  occured  before  those  In  V^.  Note  that  If 
N  does  not  deadlock,  then  V, ,V9,...  is  Infinite. 

V  . 

Let  S  be  some  state  of  N.  We  will  use  the  notation  S—*S,  where  V 
is  a  set  of  event  instances,  to  indicate  that  each  event  in  V  is  feasible 
at  S  and  that  S  is  the  state  of  N  after  the  simultaneous  occurence  of 
the  instances  in  V. 

Given  an  initial  state  S°  for  N,  it  should  be  clear  that  different 
runs  of  N  may  result  In  different  execution  histories,  depending  on  the  time 
that  each  cell  spends  In  executing  the  different  steps  of  Its  cycles.  How¬ 
ever,  any  particular  execution  history,  say  V^Vg,...,  should  satisfy  the 
following  properties: 

fPTT  There  exist  a  sequence  of  states  ^S°,S^,...,  associated  with  V^Vg,... 
such  that,  for  any  1  >  0,  That  is,  at  any  Instant  during 

execution,  only  instances  of  feasible  events  may  occur. 

[P2l  An  Instance  E^,  for  some  t  >_  1,  1  £  k  <  n  and  x  *r-,  c  or  w, 
may  occur  at  most  once  in  Vj,V2,...  •  Moreover,  if  t  >  1  and  E^  c 
for  some  1,  then  there  exist  a  j  <  1  such  that  E^j^e  Vj.  That  is, 
the  (t-l)-st  Instance  of  an  event  should  occur  before  its  t-th  Instance. 


fftl  If  • tVm  Is  finite,  then  Sm  is  a  dead  state.  That  Is, 

execution  stops  only  if  N  is  deadlocked. 

Definition  4;  Any  sequence  of  sets  of  event  instances  that  satisfies  the 
above  three  properties  Is  called  an  S°- feasible  sequence. 

By  definition,  any  execution  history  of  N  starting  from  S°  is  an 
S°-feasible  sequence.  The  mathematical  definition  of  feasible  sequences 
makes  them  easy  to  construct  and  study*  The  following  lemmas  and  definitions 
are  needed  in  order  to  prove  some  properties  about  feasible  sequences,  and 
thus  execution  histories. 

Lemma  1:  If  E  .  and  E„  _  are  two  different  events  feasible  at  a  certain 

y §H 

state  S  of  N,  then 

dom(Ex>k)n  dom(Ey  q)  *  <fr.  (3.3) 

Proof:  If  x  f  y,  then  (3.3)  follows  directly  from  Definition  2.  If  x  *  y, 

then  from  Definition  1,  (3.3)  is  false  only  if  k  =  q,  which  contradicts  the 

hypothesis  that  E„  u  and  E„  „  are  different.  ■ 

y*q 

a  V  a+1 

From  the  above  lemma,  it  is  clear  that  if  S  — *S  ,  where 

V  *  {e^,v^},  then  dom(e)n  dom(v)  *  <{>  and  hence  Sa+^  may  be  obtained 
from  Sa  by  applying  the  state  transformation  axiom  to  e  and  v  independently. 

The  following  lemma  proves  that  If  an  event  Is  feasible  at  a  certain  state 
then  it  remains  feasible  until  the  occurence  of  one  of  its  Instances. 
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Lemma  2:  Let  e  be  an  event  feasible  at  S  and  let 


sa  a+lt  $a+l_ 


m  cm 


S  •  If  V) . Vm  do  not  contain  any  Instance 


of  e,  then  e  Is  feasible  at  S  . 


Proof:  Let  e  Vg+^.  Hence,  v  is  feasible  at  Sa  and  so  Is  e  (from 

the  hypothesis).  Then,  by  Lemma  1,  dom(e)  fldom(v)  =  <f>.  But  from  the  state 
transformation  axiom,  the  occurence  of  does  affect  only  the  elements 

of  Sa  In  dom(v).  Noting  that  this  Is  valid  for  any  v^  In  Va+.j,  we 
conclude  that  Sa+j  =  Sa  j  for  (1,j)  c  dom(e)  and  hence  e  Is  feasible 
at  Sa+1.  The  feasibility  of  e  at  Sm  follows  by  repeating  the  above 
argument  m-a  times.  ■ 


Next,  we  redefine  Lamport's  partial  ordering  of  events  Ill]  to  suit  our 
particular  model. 


Definition  5:  Two  even  instances  Ij  and  I2  are  related  by  the  ordering 

II  <  o  Ig  If  for  any  S°-feas1ble  sequence  Vi>V2,...,  ^  e  Y^,  for  some  1, 
S 

implies  that  Ij  e  V j ,  for  some  j  <  1.  That  is  if  I2  does  occur  then  Ij 
should  occur  before  I2« 


By  definition,  the  relation  <  is  associative;  that  is,  if  I,  <  I, 

S°  1  s°  c 

and  ^  <  o  I3’  then  h  <  o  r3'  Note  that  *1  <  0  does  not  that 

s  s  s 

I2  e  V.j  for  some  1.  The  subscript  S°  will  be  dropped  from  <  Q  when  it 

3 

is  obvious  from  the  context. 


Lemma  3:  Given  an  initial  state  S°  for  N,  the  following  partial  orderings 
do  hold  for  any  S°-feasib1e  sequence. 


.'.*.*  *'.'**  *•  •  •  *  •  *  *  *  *  *  «.  * 


I)  For  any  1  and  t  >  1, 


p(t)  <  p(t)  .  p<t)  ,(t+l) 

Er,i  <  Ec,1  <  Ew»1  <  Er,i  ‘ 


(3 


II)  For  t  >_  1  and  any  1  and  j  with  S°  j  *  1 

p(t)  <  c(t)  r(t+1) 

Er,j  <  ^,1  <  Er,j  ‘ 


(3. 


Ill)  For  t  >_  1  and  any  1  and  j  with  S°  ^  *  -1 

c(t)  <  E(t)  E(t+1) 

Ew,i  <  Er,j  <  SM  * 


(3. 


Proof:  We  will  prove  here  only  one  of  the  seven  inequalities  involved  In 
the  lenuia.  The  proof  of  the  other  s*x  is  very  similar.  More  specifically 
we  will  prove,  by  Induction  on  t,  that  if  S?  ,  *  1  then 

1  »J  "  »J  "I* 

V  V 

Let  Vj,V2,...  be  S°-feasible  such  that  S° — U  S1  — . 


for  t  «  1 :  Assume  that  E^j  e  Vz  for  some  z,  then  Ew  j  is  feasible 

at  S2'1  and  hence  S*’j  *  -1.  But  S°  j  *  1  and,  by  the 

state  transformation  axiom,  the  (1,j)-th  entry  of  the  state 
matrix  may  be  set  to  -1  only  by  an  Instance  of  E„  Then 
there  exist  T  and  v  such  that  v  <  z  and  e1T1  e  \L.  If 
T  >  1  then,  by  property  P2  of  feasible  sequences,  there  exist 
a  q  <  v  <  z  such  that  E^j  e  Vq.  This  Is  valid  for  any 
S°-feas1ble  sequence  and  hence,  E^j  <  E^ ] . 

for  t  >  1:  Assume  that  E^j^  <  E^^.  If  E^j  e  Vz,  for  some  z, 

then,  from  property  P2,  there  exists  a  u  <  z  such  that 


C  s'  .S  w% 


W.  V  V_V_V.V_V.V_ V  -■  ■ 
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e  Vu.  But  the  feasibility  of  E^J  at  S2’1 

Implies  that  S2“j  a  -1  and  from  the  state  transformation 

axiom,  j  *  1 ,  and  only  an  instance  of  Er  j  may  set  the 

(i.j)-th  entry  of  the  state  matrix  to  -1.  Then,  there 

exist  T  and  v  such  that  u  <  v  <  z  and  e£T]  e  V  . 

However,  by  the  induction  hypothesis  E^j^  occured  before 

E^I^  and  hence,  T  >  t.  Finally,  if  T  >  t,  then  there 

exist  a  q  <  v  <  z  such  that  E^l  e  V„.  This  Is  valid  for 

r,j  Q 

any  S°-feasible  sequence  and  hence,  E^j  <  E^j.  I 


Lemma  4:  If  dom(e) D  dom(v)  *  *,  then  for  any  initial  state  S°  and  any 
t  >  1,  there  exist  a  T  >  1  such  that 


e<T>  <  0 
S° 


(3.5) 


Proof:  From  Definition  1,  it  Is  clear  that  the  following  are  the  only  cases 
where  the  domains  of  two  events  do  intersect. 

1)  dom(Er>j)ndom(Ew>i)  »  {(1,j)>,  1  t  j 

2)  dom(Exj)n  dom(Eyj)  ■  {(1,i)},  x,y  *  r,  c  or  w,  x  f  y. 

The  proof  of  (3.5)  In  the  first  case  follows  from  (3.4b/c)  and  in  the  second 
case  follows  from  (3.4a).  I 


Now,  we  are  ready  to  prove  that  the  Initial  state  is  the  only  factor 
that  affects  the  deadlock  of  a  self-timed  network.  Irrespective  or  any 
particular  execution  history. 


KO. 
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Theorem  1 :  Given  an  Initial  state  S°  of  N,  If  there  exists  a  finite 
S°-feasible  sequence,  then  any  other  S°-feasible  sequence  Is  finite.  More¬ 
over,  If  there  exists  an  Infinite  S°-feas1ble  sequence,  then  any  other 
S°-feas1ble  sequence  Is  Infinite. 


Proof:  See  the  appendix. 


Hence,  for  some  initial  states,  every  execution  of  N  will  end  In  a 
deadlock,  while  for  other  initial  states,  N  Is  deadlock-free.  This  Is  made 
more  precise  by  the  following  definition. 


Definition  6:  An  initial  state  S  is  live  if  there  exists  an  infinite 
S°- feasible  sequence.  Otherwise  S°  Is  non-live. 


By  Theorem  1,  any  execution  of  a  network  N  starting  at  a  live  initial 
state  may  not  deadlock.  On  the  other  hand,  if  N  starts  execution  from  a 
non-live  initial  state,  then  it  will  definitely  reach  a  dead  state. 


3.4  Determination  of  Live  Initial  States 


Theorem  1  all&ws  the  use  of  any  especially  constructed  feasible  sequence 
for  testing  the  liveness  of  initial  states.  In  this  section,  we  will  consider 
sequences  where  events  in  the  first  cycle  are  always  given  a  higher  priority 
to  occur.  More  specifically  we  define  "First  Cycle  First"  (FCF)  event  sequences 
as  follows: 


Definition  7:  An  S  -FCF  sequence  is  a  sequence  of  sets  of  event  instances, 
V,  .V« .  constructed  as  follows: 


constructed  as  follows: 


1)  V.j  *  £  where  Ex  k  Is  any  event  feasible  at  S  . 

y  V 

2)  For  any  1>l,let  S° — i*  S1— ...  -ts1  and  let  F1+1  be 

the  set  of  events  feasible  at  sb  If  F^  =  $  then 'terminate 

the  construction,  else  If  there  exist  an  event  Eu  e  F..,  such 

that  E^  did  not  occur  In  V, . V.,,  then  take  V..,  =  {E^b. 

y»n  i  l  iti  y»q 

Otherwise,  set  V^+1  *  {E^}  fr°r  any  Ez  p  £  Fi+1’  where  t  *s 
such  that  E^^b  but  not  E^,  did  occur  in  V^,...,V^.  ■ 

S°-FCF  sequences  are,  by  construction,  S°-feas1ble  sequences  and  hence 
they  may  be  used  to  determine  the  liveness  of  S°.  More  specifically  we  may 
prove  the  following. 

Theorem  2:  Let  V^Vg,...  be  any  S°-FCF  sequence  and  let  m  be  the  smallest 
integer  such  that  *  tE^}  for  some  x,k  and  t  +  1.  Then  S°  Is  a 
live  initial  state  If  and  only  If  m  *  3n,  where  n  is  the  order  of  the  matrix 
S°,  which  Is  the  number  of  cells  in  the  corresponding  network. 

Proof:  See  the  appendix. 

By  applying  Theorem  2,  we  may  test  the  liveness  of  a  given  initial  state 
S°  of  a  network  N  by  simulating  an  execution  history  of  N  where  only  the 
first  cycle  (3  events)  is  allowed  to  execute  In  any  cell.  If  in  this  execution 
every  cell  is  able  to  complete  its  first  cycle  then  S°  is  live,  otherewlse 
it  is  not.  The  following  algorithm,  LIVE,  does  exactly  that.  More  specifically 
it  simulates  the  execution  of  the  first  m  Instances  of  an  S°-FCF  sequence. 

At  any  particular  state,  feasible  events  are  identified  and  Instances  of  these 


events  are  executed  causing  the  appropriate  state  transformations.  However, 
only  the  first  instance  of  any  event  Is  allowed  to  occur  by  marking  any  cell 
that  completes  its  first  cycle  and  disabling  any  event  In  marked  cells.  The 
simulation  terminates  when  no  events  are  feasible  In  unmarked  cells.  The 
initial  state  is  then  declared  live  If  and  only  If,  all  the  cells  are  marked. 
Note  that  for  any  1,  E  *  becomes  feasible  Immediately  after  the  occurence 

C  9  1 

of  E^l.  Hence,  E^1]  and  E^1]  may  be  executed  in  a  single  step  as  shown 

I  |l  if  1  C  y  1 

in  the  following  algorithm 


Algorithm  LIVE 
INPUT:  St  ]  :=  S°; 

FOR  i  :=  1  TO  n  DO  Marktl] :»  False; 

REPEAT 

Blocked  :*  True 
FOR  j  :*  1  TO  n  DO 

IF  (NOT  Marktj])  AND  (SIi,j3  t  -1 »  1  ■  l,...,n)  THEN 

BEGIN  (*  E„  *  Is  feasible.  Execute  E^|  and  E^ 

r  »j  r  ij  Cy 

FOR  1  :s  1  TO  n  DO  IF  (S[i,jl  *  1)  THEN  SI1,j]  :»  -1; 
Blocked  :*  False; 

END/ 

FOR  i  :»  1  TO  n  00 

IF  (NOT  MarkCi] )  AND  (Sti.jl  t  1,  j  -  1 . n)  THEN 

BEGIN  ,(*  EWj1  Is  feasible.  Execute  E^J  *) 

FOR  j  :«  1  TO  n  DO  IF(S[1,j]  «-l)  THEN  Stl.j]  «  1; 
Blocked  :■  False; 

Marktl]  :«  True; 
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UNTIL  (Blocked); 

IF  (Marklll  »  True,  1  =  THEN  S°  Is  live 

ELSE  S°  Is  not  live 


Next,  we  would  like  to  determine  the  llveness  of  an  Initial  state  by  a 
static  analysis,  that  Is  without  any  simulation.  This  analysis  .nay  be  based 
on  the  properties  of  the  matrices  corresponding  to  live  initial  states.  For 
example,  it  is  easy  to  show  that  If  the  matrix  S°  does  not  contain  any  -1, 
then  algorithm  LIVE  will  terminate  successfully  In  one  iteration.  Also  If  S° 
is  such  that  S°  .  f  1  If  i  <  j  and  S?  ,  i  -1  if  1  >  j,  then  LIVE  will 

I 

terminate  successfully  In  at  most  n  Iterations.  However,  the  structure  of 
the  state  matrix  does  depend  on  the  particular  numbers  assigned  to  the  cells 
of  the  network,  and  hence  all  possible  numbering  schemes  should  be  considered. 
In  fact  it  may  be  proven  that  an  Initial  state  Is  live  If  and  only  If  there 
exist  a  numbering  of  the  cells  of  the  network  such  that  the  corresponding 
matrix  S°  satisfies 


IF  S1,j  *  _1  THEN  1  <  j  and  S1,q  *  1  for  q  *  j . n* 


That  is,  a  -1  may  only  appear  In  a  upper  diagonal  and  should  not  be  followed 
by  a  1  In  the  same  row. 

A  llveness  condition  that  Is  Independent  of  any  particular  numbering  of 
the  cells,  may  only  be  obtained  by  an  analysis  of  the  graph  underlying  the 
Initial  state,  rather  than  its  matrix  representation.  We  pursue  this  approach 
by  first  defining  the  Initial  s$ate  graph  as  follows: 


Definition  8:  The  Initial  state  graph  of  a  network  N  Is  a  labeled  directed 


graph  GQ  *  (V,E,L),  where  V  is  a  set  of  nodes  corresponding  to  the  cells 
in  N,  E  is  a  set  of  edges  corresponding  to  the  links  In  N  and 
L:  E  ■*  {IRE, IWE)  is  a  function  that  assigns  a  label  from  { IRE , IWE)  to 
each  edge  in  E. 

Definition  9:  If  e  and  v  are  two  nodes  in  V,  then  we  say  that  v  is 
w-reachable  from  e,  denoted  by  e~~v,  if  there  exist  1*  GQ  a  directed  path  P 
from  e  to  v  such  that  any  edge  in  P  is  IWE.  We  also  say  that  v  is 
an  R-neighbor  of  e,  denoted  by  e  -*■  v,  if  there  exist  an  IRE  edge  directed 
from  e  to  v. 


Particular  configurations  in  the  initial  state  graph  may  be  easily  shown 
to  cause  deadlock.  Consider,  for  example,  the  following  cases: 

Case  1:  If  there  exist  a  loop  with  all  Its  edges  IWE  (see  Figure  2a).  In 
this  case  every  cell  in  the  loop  will  not  be  able  to  complete  its 
first  read. 

Case  2:  If  there  exist  an  IRE  edge  that  bypasses  one  or  more  IWE  edges  (see 
Figure  2b).  In  this  case  neither  the  source  cell  of  the  IRE  link 
will  be  able  to  write  nor  its  destination  cell  will  able  to  read. 


l 
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Case  3:  If  there  exist  two  IRE  cross  links  between  two  IWE  paths  (see  Figure 
2c).  In  this  case  neither  the  source  cells  of  the  IRE  links  will  be 
able  to  write  nor  their  destination  cells  will  be  able  to  read. 

Clearly,  the  existance  of  any  of  the  above  cases  in  a  network  is  sufficient 
to  lead  the  network  to  a  deadlock.  However,  is  the  absence  of  these  cases 
sufficient  to  ensure  that  the  network  may  not  deadlock?  The  positive  answer  to 
this  question  is  given  by  the  following  theorem. 

Theorem  3:  An  initial  state  of  a  self-timed  network  N  is  live  if  and  only 
if  its  Initial  state  graph  GQ  =  (V,E,L)  satisfies  all  of  the  following 
conditions: 


i 

m 

Cl) 

there  does  not  exist  a  node  e 

e  V  with  e~*»e. 

C2) 

there  does  not  exist  two  nodes 

e,v  e  V  with  v~~e  and  v  -+•  e. 

a 

u 

m 

C3) 

there  does  not  exist  2k  nodes 

e-j.Vj  e  V,  1  *  0,...,k-l,  for  any 

k>l  with  v.j-w*ej,  i  *0,.. 

.,k-l,  v1_1  >  er  1  *  1 . k-1 

§5 

Vl  -  V 

• 

Proof: 

See  the  appendix. 

The  first  two  conditions  are  formal  expressions  for  cases  1  and  2  dis¬ 
cussed  above.  The  third  condition  is  a  general  form  of  case  3,  where  k 
IRE  cross  link! between  k  IWE  paths  form  a  cycle.  It  should  be  mentioned 
that  the  verification  of  these  conditions  may  be  straightforward  in  regular 
graphs  corresponding  to  regular  computational  arrays.  However,  it  is  expected 


X*  •* 


that  any  algorithm  for  checking  these  conditions  in  a  general  graph  will  be 

3 

of  time  complexity  at  least  equal  to  0(n  ),  which  is  the  complexity  of  the 
algorithm  LIVE. 

Having  discussed  different  methods  for  the  verification  of  the  liveness 
of  a  self- timed  computation,  we  present  in  the  next  section  a  model  that  may 
be  used  for  the  verification  of  its  results. 


4.  A  MODEL  FOR  DEADLOCK- FREE,  VLSI  CELLULAR  NETWORKS 


The  systolic  model  introduced  in  [15]  may  be  easily  generalized  to  model 
computations  performed  on  VLSI  cellular  networks.  However,  in  order  to  keep 
the  general  model  as  simple  as  possible,  we  assume  that  every  cell  in  the 
network  executes  infinitely  many  cycles.  This,  of  course,  excludes  from  the 
model  any  self-timed  computation  that  starts  execution  from  a  non-llve  state. 
But,  as  proved  in  Section  3,  this  type  of  computations  reaches  a  dead 
state  before  all  its  cells  complete  the  first  cycle,  that  Is  before  any  useful 
result  is  produced.  Hence  only  trivial  computations  are  excluded  from  the 
model  by  this  assumption. 

We  also  assume  that  the  cycles  of  the  different  cells  in  the  network  are 
synchronized  such  that  the  state  of  any  link  directed  from  a  cell  1  to 

a  cell  j,  is  WE  when  cell  i  writes  a  data  item  on  and  is  RE  when  cell 

j  reads  a  data  item  form  This  assumption  was  validated  in  Section  2 

for  both  systolic  and  self-timed  synchronizations.  It  Is  needed  to  ensure 
that  data  on  are  not  lost  or  read  more  than  once.  More  specifically, 

■  J 

given  the  definition  of  the  RE  and  WE  states,  the  state  transition  diagram 
of  may  be  represented  as  in  Figure  3.  However,  assuming  that  Er  j  and 

E^  i  do  occur  only  when  l.  ■  is  RE  and  WE,  respectively,  the  two 

reflexive  transitions  should  be  removed,  and  hence,  instances  of  Ef  j  and  Ew>i 

should  occur  alternatively.  In  other  words,  any  data  that  is  initially  on 

/ 

^ij  or  written  on  **  by  cell  i  is  read  exactly  once  by  cell  j. 

Before  presenting  the  abstract  model,  we  review  briefly  the  definitions 
of  data  sequences  and  sequence  operators  of  [151. 


Figure  3:  The  state  transition  diagram  of 

4.1  Data  Sequences  and  Sequence  Operators 

Let  N+  be  the  set  of  positive  integers,  R  be  a  set  of  data  items  of 
a  certain  type  (for  example,  real  numbers,  boolean,...),  and  set  *  R  U(5), 
where  5  is  a  special  element  called  the  "don't  care".  A  data  sequence  n 
is  then  defined  as  an  infinite  sequence  of  elements  in  Rg;  that  Is,  a 
function  n:  N+  -*■  R5.  Let  R6  be  the  set  of  all  data  sequences  that  contain 
at  most  a  finite  number  of  non-6  elements. 

Sequence  operators  are  operators  on  R^.  One  way  of  defining  sequence 
operators  is  to  extend  known  operators  from  R  to  Rg  by  applying  the  operators 
element-wise  to  the  elements  of  sequences.  For  example,  if  R  is  the  set  of 
real  numbers,  then  the  sequence  addition  +:  R,  x  R.  -*■  R.  may  be  defined  as 

O  d  d 

follows: 


n 


s  +  c  * 


n(t)  = 


[ 


S  if  £(t)  or  c(t)  a  6 

5(t)  +  ;(t)  if  5(t),;(t)  f  5 


Sequence  operators  may  also  be  defined  directly  on  Rfi,  for  example, 
we  may  define  for  any  Integer  r  >  0  the  shift  operator  Rg  -►  R^,  x  e  R^; 


as  follows: 


If  t  <  r 


n  -  nxZ  => 


r  A  1 1  v 
n(t)  = } 

$(t-r)  if  t  > 


That  is,  f*x  inserts  r  elements  equal  to  x  at  the  beginning  of  its  operand. 
If  x  *  5  then  is  simply  written  as  ftr.  Other  sequence  operators  are 
defined  in  [141  and  [151. 

An  operator  T:  [Rj]n  -*■  Rj  is  called  a  causal  operator  if  the  t-th 
element  of  its  image  does  not  depend  on  any  element  a  ^  t  in  any  of  its 

operands.  That  is,  if  n  8  r(^ . ?n)  then  n(t)  does  not  depend  on  any 

£.{(<*)»  i  8  1 . n,  a  >_  t.  If  the  condition  a  >_  t  Is  replaced  by  a  >  t, 

then  r  is  called  a  weakly  causal  operator.  Causal  and  weakly  causal  operators 
play  a  key  role  in  the  model  presented  in  the  next  section. 

4.2  The  General  Model 

Given  a  specific  VLSI  cellular  network,  we  let  R  be  the  set  of  data 
items  that  may  be  transmitted  on  any  communication  link  in  the  network,  and 
we  assume  that  each  cell  executes  Infinitely  many  cycles.  Hence,  with  each 
input  port  (or  output  port)  of  a  cell,  we  may  associate  an  Infinite  data 
sequence  on  R^.  This  sequence  represents  the  data  items  that  are  read  (or 
written)  during  the  execution  of  consecutive  cycles.  In  other  words,  we  may 
associate  two  data  sequences  with  any  communication  link  j.  Namely,  the 
sequence  of  data  written  on  j  by  cell  1,  say  X^  y  and  the  sequence 
of  data  read  from  ^  by  cell  j,  say  X^  y  Assuming  that  no  data  Is 
lost  or  read  twice,  then  X^  j  and  x^  ^  may  be  related  by 


f  X1,j  if  *1,j  1s 

{Ui  *  ]  . 

L  Vi,j  if  *i,j  is 


where  x  is  the  initial  data  on  £.  .. 

»  *J 

The  relation  between  the  sequences  on  the  output  ports  and  those  on 

the  input  ports  of  a  computational  cell  may  be  determined  from  the  specific 

details  of  step  2  of  the  algorithm  GENERIC  executed  by  the  cell.  More 

specifically,  let  Yj»**»»Ym  be  the  sequences  of  data  read  from  the  m 

input  links  of  a  particular  computation  cell  i,  and  let  L  .  be  the 

•  »  J 

sequence  of  data  items  written  by  cell  i  on  any  particular  output  link  j 
Then  for  any  t,  the  data  item  L  At)  is  computed  during  the  t-th  cycle 

1  >J 

of  cell  1  using  the  data  read  since  the  beginning  of  execution;  that  Is, 
using  any  y^a),  1  <_  i  <_  m,  o  <_  t.  In  other  words,  there  exists  a  weakly 
causal  operator  r:  ER^ ]m  -*•  Rj  such  that 


*y  =  rCYr****Ym)- 

The  sequences  of  data  read  from  and  written  on  any  given  link  are  related 
by  (4.1).  Hence,  only  one  sequence  needs  to  be  specified  for  each  link.  In 
our  model,  this  Is  chosen  to  be  the  sequence  of  data  read  from  the  link.  Any 
equation  that  relates  the  data  on  different  links  should  then  be  written  in 
terms  of  the  sequences  of  data  read  from  these  links.  For  example,  equation 
(4.2)  should  be  rewritten  using  (4.1).  in  the  form 


if 

is 

IWE 

f  (yr*  - .  »Ym) 

if 

Is 

IRE 

(4 


where  ?  *  fixr  Is  a  causal  operator. 

With  this  introduction,  we  may  now  define  the  abstract  model  for  VLSI 


cellular  networks  to  be  composed  of  the  following  components: 


|A1 ]  A  directed  multigraph  G  ■  (V,E)  that  describes  the  topology  of  the 
network,  where  V  is  a  set  of  nodes  and  E  is  a  set  of  edges,  with 
no  edge  directed  from  a  node  to  itself.  Nodes  and  edges  in  G  corres¬ 
pond  to  cells  and  links,  respectively,  in  the  network.  Each  node  is 
identified  by  a  unique  label,  and  each  edge  is  identified  by  a  pair 
(y,v),  where  v  is  the  label  of  the  node  at  which  it  terminates  and 
y  is  a  color  assigned  to  that  edge.  Edge  colors  do  not  have  to  be 
distinct.  However,  for  unique  identification  of  edges,  different  edges 
terminating  at  the  same  node  should  have  different  colors,  and  different 
edges  starting  at  the  same  node  should  also  have  different  colors.  We 
will  often  refer  to  (y,v)  as  yy. 

[ A2 1  For  each  edge  in  E  a  sequence  is  specified.  We  will  denote  the  sequence 
associated  with  a  link  yy  by  nv»  where  n  is  the  greek  letter  corres¬ 
ponding  to  y. 

fA3~l  For  each  node  v  with  q  output  edges  (q  >  0)  and  m  input  edges 

(m  >  0),  we  are  given  q,  m-ary  weakly  causal  operators  ry:  [Rg]m  Rfi 
i  =  l,...,q.  These  operators  model  the  operation  of  the  cell  corresponding 
to  v.  More  specifically,  if  5*,...,cq  and  ny,...»ny  are  the 
sequences  associated  with  the  output  and  input  edges  of  v,  respectively, 
then  the  q  relations 

z}  *  rv(r'y»....ny).  i  *  1  *•  •  •  »q 

describe  the  operation  of  the  cell.  Here  different  edges  are  dis¬ 
tinguished  by  their  colors. 

Clearly,  the  new  interpretation  of  data  sequences  is  more  general  than  the 
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one  given  In  [15].  However,  the  only  difference  In  the  components  of  the 
two  models  Is  the  restriction  Imposed  on  the  operators  r^.  Namely, 
are  required  to  be  causal  In  [15]  while  here  we  allow  alto  weakly  causal 
operators.  This  weaker  restriction  Includes  IWE  links  In  the  model  In 
addition  to  the  IRE  links  assumed  In  systolic  networks.  Note  that  the  model 
does  not  explicitly  distinguish  between  IRE  and  IWE  links.  This  distinction 
is  implicit  in  the  type  of  operator  used  to  describe  the  data  on  a  particular 
link  (see  (4.3)). 

Hence,  the  same  techniques  illustrated  In  [15]  may  be  applied  to  the 
verification  of  self-timed  networks  as  well  as  systolic  networks.  Namely, 
the  system  of  sequence  equations  describing  the  operation  of  all  the  compu¬ 
tational  cells  In  the  network  Is  written,  and  then  solved  to  obtain  the 
sequences  on  the  output  links  of  the  network  (the  Input  links  to  output  cells) 
In  terms  of  the  sequences  on  Its  Input  links  (the  output  links  of  Input  cells). 
This  Is  Illustrated  In  the  next  section  by  an  example. 


I5RW5.W, 


V  V  “  n’ 
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5.  AN  EXAMPLE;  A  FULL  MATRIX  MULTIPLICATION  NETWORK 


A  systolic  network  for  the  multiplication  of  two  full,  square  matrices. 

A  and  B,  of  order  (n+1)  was  presented  In  [51.  The  Interconnection  between 
the  computational  cells  In  this  network  for  n  *  2  Is  shown  In  Figure  4, 
where  we  also  use  the  traditional  pictorial  representation  to  specify  the 
Input  required  for  the  proper  operation  of  the  network.  As  in  the  case  of 
any  systolic  network, every link  in  the  network  Is  assumed  to  be  IRE,  carrying 
a  don't  care  5. 

A  self-timed  version  of  the  network  may  be  directly  derived  from  the 
systolic  one,  by  changing  only  the  synchronization  mechanism.  That  is  removing 
the  global  clock  and  allowing  each  cell  to  determine  the  beginning  and  the  end 
of  Its  cycles  as  described  in  Section  2.  All  the  links  In  the  network  are 
kepfIRE  with  6  on  them  and  the  Input  streams  remain  as  shown  in  Figure  4. 

The  resulting  computation  may  be  shown,  by  Theorem  3,  to  be  deadlock-free. 

In  fact,  a  self-timed  version  of  any  systolic  computation  may  be  derived 
by  changing  only  the  synchronization  mechanism.  This  type  of  self-timed 
systems  Is  guaranteed  to  be  deadlock-free  provided  that  6  Is  treated  as  a 
data  item  that  Is  read  and  written,  rather  than  a  "nothing".  However,  this 
is  not  usually  the  Intention  in  self- timed  networks.  For  Instance,  in  the 
wave  front  machine  Introduced  In  [91,  and  In  the  self-timed  versions  of  the 
networks  suggested  in  [18],  all  the  links  In  the  network  are  assumed  to  carry 
"nothing".  Initially.  That  Is,  In  our  terms,  all  links  are  IKE. 

By  Theorem  3,  a  self-timed  network  with  only  IWE  links  Is  deadlock-free 
only  if  it  does  not  contain  any  feedback.  However,  if  the  network  contains 
a  feedback,  then,  again  by  Theorem  3,  any  computation  on  this  network  will 
end  In  a  dead  state.  For  example,  If  In  the  network  of  Figure  4  all  the  links 
are  Initially  set  to  the  WE  state,  then  every  cell  will  be  blocked  waiting  for 


V.  I 
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some  Input  data  from  a  neighboring  cell. 

A  self-timed  version  of  the  matrix  multiplication  network  was  presented 
and  verified  in  [51  and  [6].  The  case  n  *  2  is  shown  In  Figure  5  where 
IWE  links  are  represented  by  dotted  lines  and  IRE  links  by  solid  lines.  The 
initial  data  on  IRE  links  are  also  shown.  Note  that  all  the  elements  of 
the  matrices  A  and  B  are  used  as  initial  data,  and  that  the  zeroes  that 
was  required  to  pad  these  elements  in  systolic  operation  are  removed. 

It  is  easy  to  check  that  the  initial  state  of  this  network  does  satisfy 
the  conditions  of  Theorem  3.  Hence,  the  computation  is  deadlock-free.  However, 
how  does  this  self-timed  network  compare  with  the  one  derived  from  the  systolic 
network  of  Figure  4  by  simply  changing  the  synchronization  mechanism?.  More 
specifically,  will  it  produce  the  results  at  a  faster  rate!  The  answer  in 
this  particular  case  is  negative,  but  more  research  is  needed  in  order  to 
find  the  answer  for  general  networks. 

We  next  apply  the  model  of  Section  4  to  verify  that  the  network  of  Figure  5 
does  indeed  produce  the  elements  of  the  product  matrix  C  *  AB. 

We  follow  the  same  scheme  used  in  [5]  to  label  each  node  in  the  network 
by  a  triplet  (i,j,k),  0  <  1,j,k  <_  n,  where  1,  j  and  k  are  the  relative 
position  of  the  node  with  respect  to  the  three  coordinates  shown  in  the  figure. 
Note  that  we  did  not  label  the  input  cells  as  these  do  not  affect  the  verification 
procedure . 

If  we  assign  the  colors  y,  z  and  x  to  the  edges  directed  to  the  south¬ 
west,  south-east  and  north,  respectively,  and  we  use  the  convention  of  Section  4 
for  labeling  the  edges  and  identifying  the  corresponding  sequences,  we  may 
describe  the  operation  of  each  cell  by  three  sequence  equations  one  for  each 
output  link,  as  follows: 


c1,j,k+l  * 

C1+l.j,k  *  [C1,j,k  +  ni ,j,k  #  ^IJ.k1 

Note  that  the  basic  pattern  of  the  three  equations  is  the  same  for  all 
the  cells  in  the  network  (all  the  cells  are  multiply/add  cells).  However, 
different  cases  have  to  be  considered  to  account  for  the  initial  states  of 
the  different  links. 

The  next  step  isthe  specification  of  the  data  sequences  on  the  input 
links  of  the  network.  Namely 


Vo.k  -  \  k  Ck  «* 

n  ,k 


k  *  0,... ,n 


flk  5* 


"i.o.n’V  n 
1  9n 


1  =  1  f m  9  • 


s* 

n»J»°  ajtn  0 


j  *  0 . n 


ci,n,o  *  na  i  6* 
n,i 


1  *  1 ... .  ,n 


Kn  n  k  *  «* 

o,n,k  o 


k  *  0,. . . ,n 


Cn  *  M  6* 
o,j,n  o 


j  *  1 , . . . ,n 


where  for  any  t.  It  is  clear  from  the  above  equations  that  no  significant 

(non-f)  Input  Is  required  besides  the  Initial  data.  Only  some  zeroes  are  required 
on  the  links  y„  .  and  z_  ,  _  ,  j,k  ■  0,  ...  ,n,  to  flush  the  results 

niviK  n9j9o 

of  the  computation.  These  results  would  be  otherwise  destroyed  by 


the  addition  of  <5  quantities  to  them. 


The  system  of  difference  equations  describing  the  cells  in  the  network 
may  then  be  solved,  with  the  given  input,  to  obtain  an  explicit  description 
of  the  outputs  on  the  links  xn+1  j  Q  and  xn+1  Q  k,  j,k  *  0,...,n.  The 
solution  is  rather  complex  and  very  similar* to  the  one  given  in  [15]  for 
the  band  matrix  multiplication  network.  We  only  give  here  the  results 


?n+l ,  j  ,o  "  Yj 


j  =  0,. . .  ,r> 


^n+1 ,o,k  ”  Yk 


where 


f  n 


Yj(t) 


=  c 


j+t-1 ,t-l 


t  <  n-j+1 


t  >  n-j+1 


and 


C  n 


Vc>  - 


( 


L  at-l ,£  b£,k+t-l  =  ct-l ,k+t-l 


0 

5 


t  <  n-k+1 


t  >  n-k+1 


That  is  the  (n-j+1)  elements  of  the  j-th  upper  diagonal,  0  1  J  <_  n,  of  the 
product  matrix  C,  will  appear  on  the  output  link  and  the 

(n-k+1)  elements  of  the  k-th  lower  diagonal,  1  ±  k  <_  n,  of  C,  will  appear 

on  zn+l ,o,k* 


6.  CONCLUDING  REMARKS 


For  the  class  of  self-timed  networks  considered  in  this  paper  we  assumed 
that  each  cell  does  not  read  its  input  unless  all  the  input  data  are  available 
and  does  not  write  its  results  until  all  previous  results  are  consumed.  Of 
course,  this  is  not  the  only  organization  for  self-timed  networks.  For  example 
a  cell  may  be  allowed  to  read  any  input  as  soon  as  it  is  available,  compute  the 
results  that  depend  on  the  read  input,  and  write  these  results,  without  waiting 
for  all  the  other  input  data  to  be  available.  Typically,  a  cell  that  copies 
an  input  item  to  an  output  link  may  start  the  copying  even  if  its  other  Inputs 
are  not  yet  available.  Although  such  organizations  were  not  considered,  the 
techniques  presented  In  this  paper  may  be  easily  modified  and  applied  to  the 
verification  of  other  types  of  self-timed  systems. 

For  this  class  of  networks,  we  proved  that  the  liveness  of  any  computation 
performed  on  a  given  network  Is  uniquely  dependent  on  the  Initial  state.  In 
this  context,  any  simulation  may  provide  a  verification  o*f  liveness.  We  also 
proved  that  a  network  is  deadlock-free  If  and  only  if  each  cell  does  complete 
the  execution  of  Its  first  cycle  In  any  execution  history.  This  means  that 
only  finite  parts  of  simulations  are  needed  for  the  verification  of  deadlock- 
free  operations.  Finally,  we  derived  the  sufficient  and  necessary  conditions 
that  may  be  used  to  determine  the  liveness  of  a  network  without  any  simulation. 
Once  a  self- timed  computation  Is  verified  to  be  deadlock-free,  the  model  of 
Section  4  may  then  be  used  to  verify  Its  results. 

It  was  possible  to  define  the  general  model  of  Section  4  such  that  the 
verification  of  liveness  Is  implicitly  included  in  the  verification  of  the 
results.  More  specifically,  data  sequences  might  have  been  defined  as  partial 
functions  (rather  than  total  functions)  from  N+  to  Rj,  with  the  Inter¬ 
pretation  that  the  t-th  element  of  a  sequence  5  associated  with  a  link  x 
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is  undefined  if  and  only  if  the  destination  cell  of  xy  does  not  complete 
the  read  in  its  t-th  cycle.  The  relations  between  the  domains  of  the  different 
sequences  should  then  be  defined  by  additional  equations  thus  complicating 
the  system  of  equations  that  models  a  computation.  Although  this  approach 
is  attractive  theoretically,  it  seemed  to  be  very  complex  for  practical 
applications,  and  a  separation  of  the  two  components  of  the  verification  was 
prefered. 
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APPENDIX 

Proof  of  Theorem  1:  Let  v] »V2»*“ *Vm  be  a  ^n,,te  S°-feas1ble  sequence  such 
V  V 

that  S°  — S1  ...  —2*  Sm  and  Sm  Is  a  dead  state.  Let  also  Wj,W2,... 

Q  A  W,  .1  Wa 

be  any  other  S-feasIble  sequence  such  that  S°  — 1*  S  — .=*  S  . ..  .  Me  will 
prove  by  induction  that  for  any  k  >_  1  and  any  I  c  there  exist  a  q  such 

that  I  e  Vq.  But  V^,...,Vm  may  contain  only  a  finite  number  of  instances 
of  events,  and  each  may  occur  only  once  in  a  feasible  sequence.  Hence, 

Hi .Wg,. . .  contains  only  a  finite  number  of  instances  of  events  and  hence  Is 
finite.  Following  is  the  Induction  proof. 

for  k  a  1 :  Let  I  e  W-j  and  assume  that  I  i  Vq,  q  *  l,...,m.  I  Is 
feasible  at  S°,  and  hence  by  Lenina  2  it  Is  feasible  at  Sm, 
which  contridicts  the  hypothesis  that  Sm  is  a  dead  state. 

Hence,  I  e  V^,  for  some  q. 

for  any  k  >  1:  Assume  that  each  Instance  of  event  In  W-j  > . . .  »W|C_1  does 
occur  in  Vj,...,Vm,  and  consider  any  I  e  where  I  may 
be  a  Instance  of  E.  E,  i  or  Eu  *  for  some  i.  Here 
we  will  only  prove  the  Induction  step  for  I  *  E^l,  for  some 
t.  The  proof  In  the  other  two  cases  Is  similar.  We  first 
define  the  sets  Rj  *  {(j,i)|  (j.1)  e  dom(Erj),  j  f*  I ,  *  1}, 

and  W1  «  {( j ,1 )  |  ( j ,1 )  e  dom(Er>1),  *  -1}.  If  t  -  1, 

then  by  Lemma  3  E^j  <  E^j  for  each  (j,1)  e  W^,  that  Is 
these  E^j  do  occur  In  W-j ,. ..  .W^ ,  and  by  the  Induction 
hypothesis,  they  also  occur  In  Vj,...,Vm.  By  the  state  trans¬ 
formation  axiom,  each  E^Jj  sets  the  corresponding  (j,1)-th 
entry  of  the  state  matrix  to  1.  Noting  that  S° j  ■  1  for 


■  -  ‘  ■ 


(j,i)  e  U  { ( 1 »1 ) >  and  that  an  entry  in  the  1-th  column 

of  the  state  matrix  that  Is  equal  to  1  may  change  only  by 

the  occurence  of  an  instance  of  E  4,  we  conclude  that  E^T], 

r,i  r»i 

for  some  T  1  does  occur  in  V-j,...,Vm»  because  otherwise 

S1?  *  would  be  equal  to  1  for  any  (j,i)  e  domfE,,  *)  which 

contradicts  the  hypothesis  that  Sm  is  a  dead  state.  Of  course 

if  T  >  1  then  E^1)  <  E^J]  and  hence  E^.1]  also  occurs  in 
r,i  r,i  r,i 

Vj,...,Vm.  Now  if  I  ■  E^j,  t  >  1,  then  from  Lemma  3, 

Eij”<Er!l  Ei!rj)<Er!l  foreach  «-1)eR1uw1- 

where  a^  *  -1  and  0  for  (j,i)  e  and  (j,i)  e  W^, 

ft-ll  (f+ai) 

respectively.  That  is  these  E^  ^  7  and  Ew  j  do  occur 

in  Wj  >. . . ,  and  by  the  Induction  hypothesis,  they  also 

occur  in  V^,...,Vm.  By  the  state  transformation  axiom,  E^*^ 

sets  the  (1,1)-th  entry  of  the  state  matrix  to  1,  and  each 
(t+aj 

Ew  J  sets  the  corresponding  (j,1)-th  entry  to  1.  Noting 
that  an  entry  In  the  1-th  column  of  the  state  matrix  that  Is 
equal  to  1  may  change  only  by  the  occurence  of  an  Instance 
of  Er  j,  and  that  by  Lemma  3,  E^j^  occurs  in  Vj,...,Vm 

ft-ll  (t+a-j) 

before  the  occurence  of  E^\j  7  or  any  Ewj  J  ,  we  conclude 
that  E^j  does  also  occur  In  V^,...,Vm  because  otherwise 
would  be  equal  to  1  for  any  (j,1)  e  dom(Er  j)  and 
hence  Sm  would  not  be  a  dead  state.  This  completes  the  proof 
of  the  first  part  of  the  theorem. 

The  second  part  of  thfc  theorem  is  a  direct  consequence  of  the  first  part J 


.  ru  .  w~u 


Proof  of  Theorem  2:  Let  S° 


1  ^2 

—  S  — * . .  and  1 et  F^  be  the  set  of  events 


feasible  at  S  .  If  m*  3n,  then  the  3n  Instances  of  events  that  occured  before 
S^n  should  be  E^,  x  *  r,c,w,  k  *  l,...,n,  and  It  Is  easy  to  show  that 
$3n  _  jO^  Nqw  wg  may  cons^ruct  the  Infinite  S°-feas1ble  sequence 

Vl**'**V3n*  Vl”**’V3n’  with  Vi  =  {Ex!k}  where  V1  =  {Ex!k}* 

This  proves,  by  Theorem  1,  that  S°  is  live.  Now  let  m  t  3n.  Clearly  m 

can't  be  larger  than  3n  because  we  may  have  only  3n  events.  Hence  m  <  3n, 

and  there  exist  a  non-empty  set  of  events  A  such  that  for  each  e  e  A; 
e  i  F„  and  e^  does  not  occur  In  V, ,...,V.  If  V  »  {v^}  for  some 
v  e  Fm  and  t  >  1  then  from  Lemma  4  dom(e)  fi  dom(v)  *  d>  for  any  e  e  A. 

But  the  occurence  of  v^  may  change  only  the  entires  of  Sm  in  dom(v), 

-■  l 

and  hence  any  e  e  A  will  not  be  feasible  at  S  .  By  repeating  this 
argument  we  may  prove  that  no  Instances  of  an  event  e  e  A  will  occur  In 
V^,V2>...  .  Pick  any  event  Ex  ^  e  A.  From  Lemma  3,  E^2],  E^2]  and  E^2] 
do  not  occur  in  V^,V2,...  because  this  would  require  the  occurence  of 

e!1]*  E*1]  and  E,^ ] ,  thus  contradicting  that  Ev  *  e  A  for  some  x  *  r,  c  or  w. 

Next,  we  will  prove  that  any  event  Ey  j  i  A  does  occur  in  V^.Vg,...  only 
finitely  many  times.  From  the  connectivity  of  the  network,  there  Is  either  a 
path  from  cell  j  to  cell  i,  or  a  path  from  cell  i  to  cell  j.  If  the  first 
case  applies  then  by  repeatedly  applying  Lemma  3  we  may  find  a  T  such  that 

E^2]  <  ^j*  and  as  Er^i  does  not  occur  *n  Vj.Vg*....  then  Ewlj*  and 

consequently  E^j1)  and  E^Tj  1  ^ ,  do  not  occur  in  ,V2 .  Similarly, 

if  there  is  a  path  from  cell  1  to  cell  j,  then  we  may  find  a  a  such  that 
E^2]  <  and  prove  that  E^°j,  E^aj  and  E^aj  do  not  occur  In  Vj,V2,...  . 

This  proves  that  only  finitely  many  event  Instances  may  occur  in  V, ,V9,...  . 
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Proof  of  Theorem  3:  Let  GQ  ■  (V,E,L)  be  an  Initial  state  graph  of  N, 

and  let  S°  be  the  Initial  state  matrix  corresponding  to  any  numbering  of 

the  cells  of  N.  First,  assume  that  Cl  Is  violated.  Then,  there  exist  a 

cycle  e, .....e,,,  such  that  .  *  -1,  1  *  1,...,m-l,  and  *  -1. 

1  m  ere1+l  em*el 

By  (3.4c)  and  (3.4a)  of  Lemma  3,  this  gives 


d'>  <  £<’>  <  £.('>  <  e!1!  ...  <  £<’>  <  E<’>  . 

w,ei 


r,e2  w,e 


2  r,e3 


w,em  r*el 


>  . 


c 


But  from  (3.4a),  <  E^  .  Hence,  neither  E^  nor  E^  do  occur 

r,e1  w,e1  w,e]  r,e] 

In  any  S  -feasible  sequence.  As  shown  In  the  proof  of  Theorem  2,  this  may  be 
used  to  prove  that  the  Initial  state  is  not  live.  The  same  technique  may  be 
applied  to  prove  that  the  Initial  state  Is  not  live  If  any  of  C2  or  C3  Is 
violated. 

Now  assume  that  all  of  Cl,  C2  and  C3  are  satisfied  In  G  .  If  the 

o 

algorithm  LIVE  Is  applied  to  S°,  then  during  Its  execution,  we  may  keep  a 
partitioning  of  the  nodes  In  GQ  Into  three  sets  TQ,  Tr  and  Tw  as  follows; 

•  Initially,  set  TQ  *  V,  Tr  *  Tw  *  d>. 

•  Whenever  an  instance  E^l  is  simulated  in  LIVE,  move  node  1  from 

r,  i 


T„  to  T  . 
o  r 


:(1) 


•  Whenever  an  Instance  Ej;  i  Is  simulated  in  LIVE,  move  node  1  from 

W*  1 


T  to  T  . 
r  w 


L‘ 


LIVE  may  be  blocked  only  If  every  column  1  with  Markll]  *  false  contains 
at  least  a  -1  entry,  and  every  row  j  with  Mark[j]  *  false  contains  at 
least  a  1  entry.  Noting  that  1)  Markte]  -  True  for  any  e  e  Tw,  2)  If  e  e  Tf 
and  v  e  TQ  then  S[e,v]  ■  S°jV,  and  3)  If  e  e  Tr  and  v  e  TrU  Tw  then 


S[e,v]  f  1,  it  may  be  easily  shown  that  if  LIVE  is  blocked,  then 

Bl)  For  any  node  e  e  T0>  there  exist  at  least  one  IWE  link  directed 

from  a  node  v  e  to  e. 

o  w  r 

B2)  For  any  node  v  e  Tr>  there  exist  at  least  one  IRE  link  directed 

to  v  from  a  node  e  e  T„. 

o 

In  order  to  prove  that  the  initial  state  Is  live,  we  will  prove,  by 

contradiction,  that  if  Cl,  C2  and  C3  are  satisfied  in  GQ,  then  there  cannot 

exist  two  disjoin  subsets  T0,Tr£  GQ  such  that  both  Bl  and  B2  are  satisfied 

Assume  that  such  TQ  and  Tr  do  exist.  We  will  first  prove  that  any 

node  e„eT„  is  W- reachable  from  a  node  v„  e  T  .  Consider  any  e„  e  r. 
oo  or  oo 

By  Bl,  there  exist  e-j  e  T0UTr  such  that  ei*~*e0*  If  el  e  Tr  then 

vQ  a  e-j  and  we  are  done,  else  e-j  e  TQ.  By  Bl,  there  exist  e2  e  TQU  Tr 

such  that  eg— *e-j.  If  e2  e  Tr  then  vQ  «  e2  and  we  are  done,  else 

e2  e  Tq  and  by  Cl  e2  f  e^,  0  ^  1  <  2.  This  argument  may  be  repeated  at 

most  d  times,  where  d  Is  the  number  of  nodes  in  TQ,  before  a  node  T 

with  v~v*r,  is  found. 
o  o 

Next,  we  will  construct  two  subsets  A.cT  and  A^cT  as  follows: 

o—o  r  —  r 

1)  Start  with  AQ  *  {eQ}  where  eQ  is  any  node  in  TQ  and  Ar  a  {vQ> 

where  v„  e  T  and  v„ — *•  e„. 
or  oo 

2)  For  k  *  1,2,... 

2.1)  Chose  «|CeT0~'A0  such  that  vk_j  -*•  ek.  The  existence  of 
such  ek  Is  discussed  later.  Set  AQ  *  AQU  {ek>* 

2.2)  Chose  vk  e  T  ~  A  such  that  vk— *ek.  Set  A  ■  A  U  (vk). 


The  existence  of  ek  e  T0>  -►  ek  Is  guaranteed  by  B2.  Also  ek  $  AQ 

because  if  ek  B  ek_1  then  by  construction  eJ(_1  and  vk-1  -*•  ek-1, 

which  contradicts  C2,  and  if  ek  s  e^  for  some  j  <  k-1,  then  vk_^  ♦  e^, 
v1-l  ‘*“ei*  *  "  j+l,...,k-l  and  v^«-*e^t  1  s  j,...,k-l.  This  clearly 
contradicts  C3.  The  existence  of  vk  Is  step  2.2  follows  from  a  similar 
argument. 

However,  L.  and  T  are  finite  and  hence  there  will  exist  a  step  k 
or 

where  either  ek  e  AQ  or  vk  c  Ar,  which  contradicts  one  of  C2  or  C3,  as 
shown  previously.  Hence  If  Cl,  C2  and  C3  are  satisfied  In  GQ,  then  a 
partitioning  of  G  that  satisfies  B1  and  B2  cannot  exist. 


